Executive brief
JupiterX Core, a foundational plugin for the JupiterX WordPress theme, contains a security flaw that allows unauthorized individuals to bypass access controls. This could allow an attacker to access sensitive information or perform actions they are not permitted to do, potentially compromising the website's data. Business operations may be impacted if sensitive site configurations or user data are exposed to the public.
Technical details
A broken access control vulnerability exists in the JupiterX Core plugin for WordPress due to missing authorization checks (CWE-862). The flaw allows an unauthenticated remote attacker to execute functions or access data that should be restricted to higher-privileged users. The vulnerability is exploitable over the network without user interaction. According to the CVSS vector, the primary impact is on confidentiality (High), while integrity and availability are not directly impacted. The issue is resolved in version 4.14.2.
Affected products
- Artbees JupiterX Core <= 4.14.1
Timeline
- 2026-02-20: other: Reported by researcher hivesec
- 2026-04-20: patched: Patch released in version 4.14.2
- 2026-06-16: disclosed: CVE published to NVD